xHunt hackers uses New Backdoor to attack Exchange Servers and the xHunt Campaign has also targeted Kuwait organizations to compromise systems. One amongst the tools used is CASHY200, which is a Powershell based back door that communicates with a C2 server using DNS tunneling.
CASHY200 works on the basis of PowerShell scripts associated with the larger xHunt malware campaign.
ThisCASHY200 is delivered through a malicious Microsoft Office attachments distributed through email phishing campaigns. Which then uses the Exchange Web Services (EWS) to create drafts within the Deleted Items folder of a compromised email account.
When the email is opened, a preliminary script in the attachments will execute CASHY200 directly in memory.
CASHY200 variants also have the ability to extract files as well as install secondary payloads.
All the versions of Microsoft Windows are known to be affected
windows64x[.]comwinx64-microsoft[.]comfirewallsupports[.]comwindows-updates[.]com
On May 1st and June 3rd 2018, the first executables were found to be installing and executing CASHY200 PowerShell which communicated with the domains windowsupdates[.]com and firewallsupports[.]com.
Despite initially being heavily targeted at government, transportation and shipping organisations in the Middle East, it now appears to be affecting organisations throughout Europe.
C2 domains such as windows64x[.]com, firewallsupports[.]com, windows-updates[.]com, and winx64-microsoft[.]com can be blocked.
All CASHY200 tunnelling protocols can be blocked by DNS Security.
Also Read
Hackers Using COVID-19 Training Lure to Attack Office 365 Users
Hackers Would Bypass Multi-Factor Authentication to Gain Full Access to Microsoft 365 Services
MAJORSU cc-stockHK